The Bill will legitimise
existing clandestine practices and introduce controls over encryption
- all on the authority of politicians and officials

The Regulation of Investigatory
Powers Bill has 73 clauses and 4 lengthy Schedules plus 357 points
in the "Explanatory Notes". It is presented in three
main sections: Part I - Interception of communications; Part
II - Intrusive Investigation Techniques; Part III - Decryption
powers.

Part I - Interception
of communications

This section incomprehensibly
starts with defining "unlawful interception" which
covers interception by anyone not authorised by the state (Home
Secretary, judge or a host of others). Though it makes "lawful"
real-time interception (as it is happening) if carried out by
a person who has the right to "control the operation or
use of the system" or who has "the express or implied
consent of such a person" (Article 1.6). This proposed lawful
power extends to collecting and storing a communication that
"is being, or has been, transmitted" or while being
transmitted is "diverted or recorded" and to "data
attached to a communication" (Article 2.7, 2.8, 2.9).

Article 3 plunges straight into
"Lawful interception without a warrant" (both post
and communications). It is lawful, without a warrant, if one
of the parties (the sender or receiver) consents or if "surveillance..
has been authorised in Part II" (covert investigations).

Article 4 extends the categories
where interception is "lawful" without a warrant. It
covers prisons, hospitals and patients under the Mental Health
Act 1983. It also covers any "business", which can
by authorised by the Home Secretary by regulation, to
monitor or record all communications conducted by that business.
"Business" in this section is defined as including
government departments, "any public authority" and
any person given authorisation.

This Article also makes "lawful"
the interception of communications in line with the EU draft
Convention on Mutual Assistance in criminal matters without a
warrant. It allows the interception of communications of a person
in another country through telecommunications systems
based in the UK due to an interception warrant issued in that
country. No limits are placed on the use made of the intercepted
material, ie: it does not have to be used for the grounds on
which the interception was requested.

Article 5 finally gets around
to dealing with instances where a warrant is needed
for the interception of telecommunications and postal services.

Article 5.1.b. covers intercepting
communications (post and telecommunications) at the request of
a non-UK state or agency under an "international mutual
assistance agreement". While Article 5.1.c. allows the Home
Secretary to request interception of communications outside the
UK. Article 5.1.d. covers "intercepted material" and
"communications data" (electronic communications).

Article 5.1.3 sets out the criteria
for issuing warrants: a) "in the interests of national security"
(valid for up to six months); b) "for the purpose of preventing
or detecting serious crime" (valid for up to three months);
c) "for the purpose of safeguarding the economic well-being
of the UK" (valid for up to six months, for people outside
the UK); d) for international mutual assistance agreements.

Hidden at the back of this lengthy
Bill in section 71 (2) and (3) is the definition of "serious
crime". This includes:

conduct by a large number
of persons in pursuit of a common purpose

The Explanatory note says this
reflects Article 8 of the European Convention on Human Rights
which refers to "disorder and crime".

The concept of "national
security" is as usual not defined and is subject to the
changing perceptions of governments, ministers and officials
of all kinds. Liberty, observes: "If Parliament
has not judged an activity sufficiently grave or insidious to
justify bringing it within the criminal law, then it should not
generally be regarded as a legitimate basis for interception
or surveillance."

Article 5.6 says that an interception
warrant covers "all such conduct.. as is necessary to undertake
in order to do what is expressly authorised or required by the
warrant."

Article 6 sets out the agencies
which can request an interception warrant: MI5, MI6, GCHQ, NCIS,
the police, customs, Permanent Under-Secretary at the Ministry
of Defence plus non-UK states and agencies under mutual assistance.
For international mutual assistance a "senior official"
can issue a warrant where the person under surveillance is outside
the UK (including "real-time" surveillance). Where
it involves satellite telecommunications (Iridium-like "ground
stations") warrants a senior official can issue a warrant
"without further formality" as the UK is apparently
not concerned with the validity or not of the warrant issued
by the non-UK state or agency.

Article 8.3.b. provides that
the Home Secretary has to issue a "certificate" setting
out a "descriptions of intercepted material" required
- this is directly relevant to telecommunications service providers.
Article 11 sets out penalties for failure to cooperate: up to
two years or an unlimited fine or both on indictment or up to
six months or a fine or both in a magistrates court (summary
conviction). Article 12 sets out obligations on service providers
to assist in interception.

Articles 16 says that no reference
or assertion may be made in any legal proceedings to the existence
or not of an interception warrant. Article 17 allows exceptions
for the prosecution and a judge to be shown the evidence - but
not the defence.

Article 18 provides draconian
sentences for people who reveal the existence of an interception
warrant or the content of a communication or communication data
(not the contents but the details of the sender and receiver
of a message) revealed by the surveillance, including everyone
who works for the postal service or for a telecommunications
provider (including ISPs). This information is to be kept "secret"
for all time. It provides for up to five years in prison or an
unlimited fine or both on conviction.

Obtaining and disclosing
"communications data"

Article 20 includes the definition
of "communications data" as including "any information
which includes none of the contents of a communication".
This obscure definition can best be understood by looking at
the categories of information set out in an EU document - ENFOPOL
98 (the EU-FBI surveillance plans). This says the law enforcement
agencies need: the IP address, customer account no and address,
logon ID and password used, PIN number, e-mail address and any
credit card details. It would also details of messages sent and
received and to/from whom. The Article also covers the postal
services.

The Article allows for authorisations
(as distinct from warrants above) and the serving of notices
by "a person designated" (see below) on the following
grounds:

a) "in the interests
of national security"

b) "for the purpose
of preventing or detecting crime or of preventing disorder"...

c) "in the interests
of public safety"

The test here is quite different
and simply defined as "crime" (not serious crime) with
"disorder" added. It also covers protecting public
health, collecting taxes, and "for any purpose..
specified.. by an order made by the Secretary of State"
(Article 21.h, emphasis added).

Article 21.3 allows a person
in a "public authority" (to be set out by the Home
Secretary) to anybody else in the same authority to issue an
authorisation/notice on a communications provider for communications
data (for a period of up to one month, renewable).

Article 21.4 says that where
it "appears" to the potentially thousands of "designated"
people in public authorities that a "postal or telecommunications
operator is or may be" (emphasis added) in possession
of communications data they can serve a "notice" on
them to obtain and disclose this to them whether "old"
data or new data.

The assumption that access to
communications data is a lesser intrusion into the rights of
privacy that interception is unacceptable.

PART II:

Surveillance and "covert
human intelligence sources"

The core of a surveillance state
is the combination of intercepting communications and direct
sources (informants and listening devices). Part II of the R.I.P.
Bill makes lawful previous dubious and "unlawful" practices.

Three types of surveillance are
to be "authorised":

a) "directed surveillance":
this is so called on the grounds that "surveillance is directed
if it is covert but not intrusive" (Article 25.2).

The grounds for issuing authorisations
for "directed surveillance" include "national
security", "preventing or detecting crime or of preventing
disorder", and for "any purpose" laid down by
the Home Secretary (Article 27.3).

The people able to issue authorisations
are those "offices, ranks and positions with relevant public
authorities" laid down (but not set out here) by the Home
Secretary.

b) "intrusive surveillance":
surveillance is "intrusive" if it is "covert surveillance".
Surveillance is thus "intrusive" if a device (whether
to record sound or video) is put in a "residential premises"
(but by implication not if it is not a residential premises,
like place of work or meeting place). It is intrusive if it involves
as it is politely termed "an individual" (ie: undercover
agent or informant). It is also intrusive if a listening device
is in a vehicle, but it is not "intrusive" if a tracking
device is attached to a vehicle to plot its location. However,
it is "intrusive" if a "device" outside a
premises or vehicle produces information of the "same quality
and detail" as might be obtained from a device actually
present in the premises or vehicles.

The grounds for issuing authorisations
for "intrusive surveillance" include "national
security", "preventing or detecting serious crime",
and for "any purpose" laid down by the Home Secretary
(Articles 30 and 33).

The people able to issue authorisations
are "senior authorising officers" in the police, military
or customs. Police and customs have to refer authorisations to
the Surveillance Commissioner.

c) "the conduct
and use of covert human intelligence sources":
covers "inducing, asking and assisting" a source. What
the term "inducing" means is not set out ("inducing"
could include turning a blind eye to a criminal offence). The
"covert" source is exempted from civil liability for
"incidental" conduct (Article 26.2.a) and the "conduct"
can be authorised for "conduct" outside the UK (the
terminology is original). Although not spelt out "covert
human intelligence sources" cover undercover agents, paid
and unpaid, and "induced" informants.

The grounds for issuing authorisations
for "the use of a covert human intelligence source"
include "national security", "preventing or detecting
crime or of preventing disorder" (a lesser standard than
for "intrusive" surveillance), and for "any purpose"
laid down by the Home Secretary (Article 28.).

The people able to issue authorisations
are those "offices, ranks and positions with relevant public
authorities" laid down (but not set out here) by the Home
Secretary.

PART III:

Investigation of electronic
data protected by encryption

This Section of the Bill introduces
notices requiring service providers to disclose encryption
"keys", known as a "section 46 notice". The
grounds for such a notice include: "national security"
and "preventing and detecting crime" (again a lesser
standard). Failure to surrender a "key" could land
a person in jail for up to two years or an unlimited fine or
both. However, failure to keep "secret" the fact that
a "key" has been given to a state agency can bring
a jail sentence up to five years.

These proposals fail to address
the fact that parties (sender and receiver) can encrypt messages
"at source", the "key" in these cases would
not be in the hands of the service provider. For a more detailed
critique of Part III see: http://www.fipr.org.uk

Commissioners and the
Tribunal

Two Commissioners are to be appointed,
the Interception of Communications Commissioner and the Covert
Investigations Commissioner as is a Tribunal (to hear complaints).
The Tribunal, along the lines of the existing ones covering interception
and the security services, has powers (to hear evidence without
the complainant being present and to suppress any evidence which
would endanger the "public interest" etc).

Conclusion

A number of overall comments
need to be made. First, the concept of "crime" used
to justify such surveillance. "Serious crime", used
in the powers for interception, includes "conduct by a large
number of persons in pursuit of a common purpose" which
could be used against political groups and activists and/or demonstrations.
In other areas there is the lesser test of simply "crime",
any crime however minor. While the provisions on "communications
data" and covert, undercover, surveillance are expressly
extended to cover "disorder".

Second, the power, whether under
warrants or authorisations, given to state agencies (police,
customs, immigration, tax, health bodies and local authorities)
to undertake surveillance amount to self-authorisation by politicians
or officials. Liberty say:

Retention of executive rather
than prior judicial authorisation of interception is fundamentally
objectionable. That the executive should secretly authorise itself
to commit clandestine interferences with important rights is
neither acceptable or necessary.

Third, there is nothing to prevent
the issuing of a warrant, authorisations or notices to cover
an organisation or group and hence for the conducting of general
surveillance ("fishing or trawling expeditions").

Fourth, the whole emphasis on
the Bill is that the use of all these new legal powers is to
be kept secret - and like the Official Secrets Acts the people
involved have to take their "secrets" to the grave.

The fact that the Home Secretary
has assured the nation that the R.I.P. Bill is in line with the
European Convention provides little comfort. Nor will the appointment
of two Commissioners, whose role will be defined by the open-ended
powers given for surveillance. The Tribunal can be expected to
be as toothless as the existing ones - which have never found
in favour of a complainant. But then how can people know they
are under surveillance, for proper or perverse reasons, if they
never find out?

The Data Protection Working Party
for the European Commission said in its report in May 1999 that:

a person under surveillance
[should] be informed of this as soon as possible.

This would ensure a proper test
of whether or not the surveillance was legitimate (see Statewatch,
vol 9 nos 3 & 4). The government's analysis of the responses
to it's consultation paper on interception says this is "an
idea that law enforcement felt to be unworkable".

It may be a sad truism but too
often this government when it lays down new legislation affecting
civil liberties diminishes the rights of the people at the expense
of the demands of "law and order" and the "law
enforcement agencies", diminishing privacy and freedoms
bit by bit and Bill by Bill.